picard3
maintainer SamWhited
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source URL is hosted on data.musicbrainz.org, a non-whitelisted but plausibly official and project-owned domain for MusicBrainz; the package builds from source and installs Python dependencies normally, posing low risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL is hosted on data.musicbrainz.org, a non-whitelisted but plausibly official and project-owned domain for MusicBrainz; the package builds from source and installs Python dependencies normally, posing low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:43
source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sam Whited <sam@samwhited.com>
2
# Contributor: David Runge <dvzrv@archlinux.org>
3
# Contributor: Gaetan Bisson <bisson@archlinux.org>
4
# Contributor: Mateusz Herych <heniekk@gmail.com>
5
# Contributor: sysrq
6
7
_pkgname=picard
8
pkgname="${_pkgname}3"
9
pkgver=3.0.0b7
10
pkgrel=1
11
pkgdesc="Official MusicBrainz tagger"
12
arch=(x86_64)
13
url="https://github.com/metabrainz/picard"
14
license=(GPL-2.0-or-later)
15
provides=(picard)
16
conflicts=(picard)
17
depends=(
18
glibc
19
hicolor-icon-theme
20
python
21
python-dateutil
22
python-discid
23
python-fasteners
24
python-markdown
25
python-mutagen
26
python-pyjwt
27
python-pyqt6
28
python-yaml
29
)
30
makedepends=(
31
python-build
32
python-installer
33
python-setuptools
34
python-wheel
35
)
36
checkdepends=(python-pytest)
37
optdepends=(
38
'chromaprint: fingerprinting'
39
'python-pygit2: plugin installation'
40
'qt6-multimedia: media player toolbar'
41
'qt6-translations: full UI translation'
42
)
43
source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
44
sha256sums=('075e3e77a6e8425b2c38dd3e83e81fc0e255209ab03f771ca6a936aedc4e8d70')
45
46
build() {
47
cd $_pkgname-$pkgver
48
PICARD_DISABLE_AUTOUPDATE=1 python -m build --wheel --no-isolation
49
}
50
51
package() {
52
cd $_pkgname-$pkgver
53
python -m installer --destdir="$pkgdir" dist/*.whl
54
install -vDm 644 {AUTHORS.txt,{CONTRIBUTING,NEWS,README}.md} -t "$pkgdir/usr/share/doc/$pkgname/"
55
}
56
57
# vim:set ts=2 sw=2 et:
58
Changes since previous scan
--- PKGBUILD @ 2026-07-17 00:06+++ PKGBUILD @ 2026-08-03 00:08@@ -6,7 +6,7 @@ _pkgname=picard pkgname="${_pkgname}3"-pkgver=3.0.0b4+pkgver=3.0.0b7 pkgrel=1 pkgdesc="Official MusicBrainz tagger" arch=(x86_64)@@ -41,7 +41,7 @@ 'qt6-translations: full UI translation' ) source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")-sha256sums=('48049cb90f54fa035269b923e4a97928ff01550a29246bb0d69b1402d9bca884')+sha256sums=('075e3e77a6e8425b2c38dd3e83e81fc0e255209ab03f771ca6a936aedc4e8d70') build() { cd $_pkgname-$pkgverScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 03:53:53 | MEDIUM | 1 |
| 2026-07-17 01:53:03 | MEDIUM | 1 |
| 2026-07-17 00:06:16 | LOW | 2 |